- Pages
- 20
- Vendors
- 33
- Scanned
- Aug 8, 2026
A real consent-aware scan showing what happened before a choice, after Accept all and after Reject all. Start with the action plan, then inspect the evidence.
This site is owned by an EU-based company. Corporate ownership is separate from domain relationship: requests are classified as first-party or third-party by registrable domain. The EU Independence Score considers both site ownership and observed external services.
Summary
The scan scope, headline observations and ownership profile.
19 tracking-related services sent requests after selecting “Avvis”. Baseline inventory across 20 pages contained 33 observed services, 46 third-party hostnames and 4 unmatched domains. On the same 5 comparison pages, observed services changed from 27 before choice to 42 after Accept all.
After Accept all: 11 additional US-owned services, 25 total observed.
Action plan
Recommended next steps, ordered by urgency and technical impact.
Priority action plan
5 recommended actions, ordered by urgency and technical impact.
- Step 1CON-001critical priorityReproduce the reject flow, then ask your CMP or developer to gate these tags so they stay blocked when consent is refused.high confidenceObserved: 19 non-essential services sent requests after selecting “Avvis”. Adform, Adnuntius and DoubleClick / Google Ads (additional domains) +16 more sent post-interaction requests. Check whether they should load when consent is refused.high confidenceDone when: A clean retest records no requests to the identified non-essential services after selecting “Avvis” on every comparison page.
- Step 2CON-002high priorityMove these tags behind the consent banner so they only load after the visitor opts in.high confidenceObserved: 18 third-party trackers loaded before consent. Adform, Adnuntius and Echobox +15 more fired on a no-interaction page load, before any consent banner was answered.high confidenceDone when: A new baseline inventory scan records no requests to the identified non-essential third-party services before consent on every URL where they were previously observed.
- Step 3TRF-001medium priorityFor each US-owned service, verify the legal entity and possible mechanism, document the review decision, or assess a European alternative.high confidenceObserved: 14 US-owned services observed before consent. 11 additional US-owned services were first observed after Accept all, for 25 total. Ownership and DPF matches are review signals, not proof of the applicable mechanism.high confidenceDone when: Every identified US-owned service has a verified legal entity, an internal review decision and, where applicable, a documented transfer mechanism, or has been removed from the observed stack.
- Step 4DSC-001medium priorityCheck each service against your cookie, privacy and consent documentation, and add any that are genuinely missing.high confidenceObserved: 37 services have no match in checked disclosure sources. No service, domain, provider or parent match was found in the checked policy documents. CMP disclosure was not assessed in this report. Automated matching can still miss a disclosure.high confidenceDone when: Every no-match service has been reviewed. Services that require disclosure are appropriately reflected in the applicable privacy, cookie or consent documentation, and remaining exceptions have a documented review decision.
- Step 5DSC-002medium priorityReview the declared cookie duration together with the browser configuration and assign the correction to the CMP or policy owner.high confidenceObserved: 2 cookie declarations differ from the observed persistent lifetime. consentUUID and consentDate are declared as 30 dager but observed with approximately 365 days remaining.high confidenceDone when: The browser configuration and published declaration agree, or the difference has a documented explanation.
Technical observations from an automated scan, ordered by likely impact. Not legal advice. Each item is a starting point for review, not a compliance verdict.
Consent audit
What the same selected pages did before a choice, after Accept all and after Reject non-essential.
Reject non-essential verdict
Does the Reject non-essential choice actually stop non-essential services? We activate the available control on a clean visit, then watch which services keep firing.
- Interaction confirmation
- UI dismissed
- Stored consent-state confirmation
- Not independently established (stored TCF state unchanged)
- Network monitoring start
- 2026-08-08T19:03:22.965Z
19 tracking services kept sending requestsafter selecting “Avvis”. The completed Reject non-essential interaction did not prevent these services from sending requests. Review whether these should fire when consent is refused.
Review services active after rejection19
- AdformEUAdvertising
- AdnuntiusEUAdvertising
- DoubleClick / Google Ads (additional domains)US-ownedAdvertising
- EchoboxEUAnalytics
- Facebook SDK & EmbedsUS-ownedSocial / Embed
- Google AdsUS-ownedAdvertising
- Google Publisher TagUS-ownedAdvertising
- Improve Digital (360yield)EUAdvertising
- Index Exchange (Casale Media)CanadaAdvertising
- Instagram EmbedUS-ownedSocial / Embed
- KilkayaEUAnalytics
- Magnite (Rubicon Project)US-ownedAdvertising
- MazeUS-ownedProduct Analytics
- MedialabenEUAdvertising
- MedietallEUAnalytics
- PubMaticUS-ownedAdvertising
- ReadpeakEUAdvertising
- SmartyAdsUnknownAdvertising
- Xandr / AppNexusUS-ownedAdvertising
A technical observation of network activity after an automated rejection, not a legal ruling. We only count advertising, analytics and similar non-essential vendors; functional and infrastructure services are ignored. Some banners hide reject behind a settings panel we may not reach automatically.
https://www.dagbladet.no/Storage evidence · 16 unique keys before / 18 after · 2 added · 0 removed · 2 changed · TC String changed
https://www.dagbladet.no · localStorage · _sp_user_consent_279548035 B/3361ca5320b5 -> 10979 B/c6f87c8c502fhttps://www.google.com · localStorage · rc::hnone -> 13 B/b2c507cdd68ehttps://www.google.com · sessionStorage · rc::enone -> 1 B/6b86b273ff34null · localStorage · _sp_user_consent_279548035 B/3361ca5320b5 -> 10979 B/c6f87c8c502fTCF API · changed · b3e385741f0a -> e2ec2bb3de5c
TCF state · event useractioncomplete · CMP loaded · 3/4 purposes granted
Values are represented only by UTF-8 byte length and SHA-256 hash.
https://www.dagbladet.no/Storage evidence · 16 unique keys before / 16 after · 0 added · 0 removed · 0 changed · TC String unchanged
TCF API · unchanged · b3e385741f0a -> b3e385741f0a
TCF state · event cmpuishown · CMP loaded
Values are represented only by UTF-8 byte length and SHA-256 hash.
Page and consent coverage
Direct consent comparisons use the same 5 pages in every completed state. 17 additional pages were scanned for broader inventory only.
- Baseline inventory URLs
- 20
- Consent comparison URLs
- 5
- Comparison in baseline
- 3
- Extra comparison URLs
- 2
- Unique URLs visited
- 22
- Completed page visits
- 30
- /Consent comparison
- No interaction
- Completed
- Accept all
- Completed
- Reject non-essential
- Completed
- /nyheterConsent comparison
- No interaction
- Completed
- Accept all
- Completed
- Reject non-essential
- Completed
- /video/program/nyheterConsent comparison
- No interaction
- Completed
- Accept all
- Completed
- Reject non-essential
- Completed
- /nyheter/na-skjer-det-vi-advarte-om/84986374Consent comparison
- No interaction
- Completed
- Accept all
- Completed
- Reject non-essential
- Completed
- /nyheter/ikke-tro-du-er-deilig-nok-til-a-bli-voldtatt/84991073Consent comparison
- No interaction
- Completed
- Accept all
- Completed
- Reject non-essential
- Completed
Show 17 extended inventory pages
- /fotball/2026-08-08/1/events/2713681
- /studio
- /video
- /info
- /kjop-pluss
- /sport
- /meninger
- /kjendis
- /bok
- /pluss
- /eavis
- /eavis/sok
- /pluss/bedrift
- /hc/no
- /video/category/underholdning
- /video/program/rod-loper
- /video/program/tv-sporten
Inventory-only pages contribute to the broader vendor inventory, but not to direct consent-state comparisons. Incomplete means the automated visit or consent action could not finish for that page.
18 third-party trackers loaded before consent
These fired on the initial page load, before the visitor accepted or rejected the consent banner. A visitor who declines would still have been exposed to them.
Review trackers and request evidence18
- Google AnalyticsAnalyticsUS-owned
- Google Publisher TagAdvertisingUS-owned
- Magnite (Rubicon Project)AdvertisingUS-owned
- MazeProduct AnalyticsUS-owned
- PubMaticAdvertisingUS-owned
- SmartyAdsAdvertisingUnknown
- Xandr / AppNexusAdvertisingUS-owned
- AdformAdvertisingEU
- AdnuntiusAdvertisingEU
- EchoboxAnalyticsEU
- Improve Digital (360yield)AdvertisingEU
- Index Exchange (Casale Media)AdvertisingCanada
- KilkayaAnalyticsEU
- MediaconnectMarketing AutomationEEA
- MedialabenAdvertisingEU
- MedietallAnalyticsEU
- Norsk Tipping PartnerAffiliateEEA
- ReadpeakAdvertisingEU
This is a technical observation of what loaded, not a legal assessment. Whether consent was required depends on the technology’s purpose and operation, including whether an applicable consent exemption may apply. This requires legal review.
Based on one clean no-interaction load per scanned URL on 8 Aug 2026. Lazily loaded trackers (e.g. on scroll or click) may not appear. Observations are deduplicated by service across the baseline inventory.
15 additional services load after consent
We clicked “Accept all” on the consent banner and revisited the selected comparison pages. The items below appear only after consent and would not load for a visitor who declines. The full vendor and cookie tables further down already include these post-consent items.
Banner matched: Sourcepoint (TCF)
Cookies set after consent
Additional third-party hosts after consent
Disclosure review
Observed services compared with readable policies and consent-manager disclosures.
Disclosure gap
The services this site loads, checked against the 2 policy documents we could read (cookie / privacy / DPA). Compared against multiple policy documents.
Documents checked
- PrivacyPersonvern i Aller Media
Stated update: 4 June 2026 · Fetched: 8 August 2026 · SHA-256: 9a0549dfa6e3…
- CookiePersonvern i Aller Media
Stated update: 4 June 2026 · Fetched: 8 August 2026 · SHA-256: 29428efb374f…
CMP disclosure source
Inspection: Not included in this report. Additional CMP matches were not assessed.
37 services have no match in the disclosure sources we checked. 8 additional services have a provider or parent match, but the specific service name was not found. This is a technical observation, not a legal finding.
Exact service matches 3
- Aller MediaEUCDN / Hosting
Matched phrase: “aller.com” · Privacy policy
- CloudflareUS-ownedCDN / Hosting
Matched phrase: “Cloudflare” · Cookie policy
- KilkayaEUAnalytics
Matched phrase: “Kilkaya” · Cookie policy
Provider or parent named 8
- AWS CloudFrontUS-ownedCDN / Hosting
Provider named as “Amazon Web Services”; specific service not found · Cookie
- Dagbladet apps (Aller Media)EEACDN / Hosting
Provider named as “Aller Media”; specific service not found · Privacy
- Google Ad Traffic QualityUS-ownedSecurity / Bot Protection
Provider named as “Google”; specific service not found · Cookie
- Google AnalyticsUS-ownedAnalytics
Provider named as “Google”; specific service not found · Cookie
- Google FontsUS-ownedFonts
Provider named as “Google”; specific service not found · Cookie
- Google APIs / GStaticUS-ownedCDN / Hosting
Provider named as “Google”; specific service not found · Cookie
- Google Publisher TagUS-ownedAdvertising
Provider named as “Google”; specific service not found · Cookie
- reCAPTCHAUS-ownedSecurity / Bot Protection
Provider named as “Google”; specific service not found · Cookie
No match found · priority order 37
- AdformEUAdvertisingBefore choice
- AdnuntiusEUAdvertisingBefore choice
- Bunny.netEUCDN / HostingBefore choice
- Dagbladet static (dbstatic.no)EUCDN / HostingBefore choice
- EchoboxEUAnalyticsBefore choice
- i18nexusUS-ownedJS Library / CDNBefore choice
- Improve Digital (360yield)EUAdvertisingBefore choice
- Index Exchange (Casale Media)CanadaAdvertisingBefore choice
- jsDelivrGlobalCDN / HostingBefore choice
- JW PlayerUS-ownedVideo / EmbedBefore choice
- Magnite (Rubicon Project)US-ownedAdvertisingBefore choice
- MazeUS-ownedProduct AnalyticsBefore choice
- MediaconnectEEAMarketing AutomationBefore choice
- MedialabenEUAdvertisingBefore choice
- MedietallEUAnalyticsBefore choice
- NIFS (Norsk og Internasjonal Fotball-Statistikk)EEAVideo / EmbedBefore choice
- Norsk Tipping PartnerEEAAffiliateBefore choice
- NTB (Norsk Telegrambyrå)EEAVideo / EmbedBefore choice
- PubMaticUS-ownedAdvertisingBefore choice
- ReadpeakEUAdvertisingBefore choice
- SmartyAdsUnknownAdvertisingBefore choice
- SourcepointUS-ownedCookie ConsentBefore choice
- Xandr / AppNexusUS-ownedAdvertisingBefore choice
- ZendeskUS-ownedCustomer SupportBefore choice
- Adobe (Marketing / Analytics)US-ownedProduct AnalyticsAfter Accept only
- Amazon AdsUS-ownedAdvertisingAfter Accept only
- Nielsen eXelateUS-ownedAdvertisingAfter Accept only
- OnAudienceEUAdvertisingAfter Accept only
- OpenXUS-ownedAdvertisingAfter Accept only
- RTB HouseEUAdvertisingAfter Accept only
- SemasioEUAdvertisingAfter Accept only
- SharethroughUS-ownedAdvertisingAfter Accept only
- Smart AdServer / EquativEUAdvertisingAfter Accept only
- SovrnUS-ownedAdvertisingAfter Accept only
- The Trade DeskUS-ownedAdvertisingAfter Accept only
- TripleLiftUS-ownedAdvertisingAfter Accept only
- YieldmoUS-ownedAdvertisingAfter Accept only
We match service names and domains against policy text and, when available, configured vendor names exposed by the consent manager. A configured CMP entry is technical disclosure evidence, not proof that the legal disclosure is sufficient. Treat any remaining gap as a prompt to verify.
Evidence appendix
The underlying cookies, transfer worksheet, infrastructure, score and complete vendor inventory.
Observed external services and transfer review worksheet
Technical observations that can support updates to processing records and vendor registers. Legal and organisational fields require customer verification.
Exposure matrix
| EU / EEA ownership | Adequacy / DPF signal | Customer review required | |
|---|---|---|---|
| Before consent | 16 | 10 | 7 |
| After consent only | 4 | 6 | 5 |
Cells count observed services. This is an exposure overview to help you prioritise. It is not a GDPR risk rating.
Open observed-service worksheet48
- Before consenti18nexusJS Library / CDNUS-ownedDPF status unknown; customer verification required
- Before consentjsDelivrCDN / HostingGlobalPossible mechanism unknown; customer verification required
- Before consentJW PlayerVideo / EmbedUS-ownedDPF status unknown; customer verification required
- Before consentMagnite (Rubicon Project)AdvertisingUS-ownedDPF status unknown; customer verification required
- Before consentMazeProduct AnalyticsUS-ownedDPF status unknown; customer verification required
- Before consentSmartyAdsAdvertisingUnknownPossible mechanism unknown; customer verification required
- Before consentSourcepointCookie ConsentUS-ownedDPF status unknown; customer verification required
- After consentAdobe (Marketing / Analytics)Product AnalyticsUS-ownedDPF status unknown; customer verification required
- After consentNielsen eXelateNielsenAdvertisingUS-ownedDPF status unknown; customer verification required
- After consentSharethroughEquativAdvertisingUS-ownedDPF status unknown; customer verification required
- After consentSovrnAdvertisingUS-ownedDPF status unknown; customer verification required
- After consentYieldmoAdvertisingUS-ownedDPF status unknown; customer verification required
- Before consentAWS CloudFrontAmazonCDN / HostingUS-ownedDPF may apply to the matched entity; customer verification required
- Before consentCloudflareCDN / HostingUS-ownedDPF may apply to the matched entity; customer verification requiredVerified 3 Aug 2026 · Cloudflare, Inc.
- Before consentGoogle AnalyticsAlphabetAnalyticsUS-ownedDPF may apply to the matched entity; customer verification required
- Before consentGoogle APIs / GStaticAlphabetCDN / HostingUS-ownedDPF may apply to the matched entity; customer verification required
- Before consentGoogle FontsAlphabetFontsUS-ownedDPF may apply to the matched entity; customer verification required
- Before consentGoogle Publisher TagAlphabetAdvertisingUS-ownedDPF may apply to the matched entity; customer verification required
- Before consentIndex Exchange (Casale Media)AdvertisingCanadaCanadian adequacy may apply to qualifying organisations; customer verification required
- Before consentPubMaticAdvertisingUS-ownedDPF may apply to the matched entity; customer verification requiredVerified 3 Aug 2026 · PubMatic Inc.
- Before consentXandr / AppNexusMicrosoftAdvertisingUS-ownedDPF may apply to the matched entity; customer verification required
- Before consentZendeskCustomer SupportUS-ownedDPF may apply to the matched entity; customer verification requiredVerified 3 Aug 2026 · Zendesk, Inc.
- After consentAmazon AdsAmazonAdvertisingUS-ownedDPF may apply to the matched entity; customer verification required
- After consentGoogle Ad Traffic QualityAlphabetSecurity / Bot ProtectionUS-ownedDPF may apply to the matched entity; customer verification required
- After consentOpenXAdvertisingUS-ownedDPF may apply to the matched entity; customer verification requiredVerified 3 Aug 2026 · OpenX
- After consentreCAPTCHAAlphabetSecurity / Bot ProtectionUS-ownedDPF may apply to the matched entity; customer verification required
- After consentThe Trade DeskAdvertisingUS-ownedDPF may apply to the matched entity; customer verification requiredVerified 3 Aug 2026 · The Trade Desk, Inc.
- After consentTripleLiftAdvertisingUS-ownedDPF may apply to the matched entity; customer verification requiredVerified 3 Aug 2026 · TripleLift
- Before consentAdformAdvertisingEUNo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- Before consentAdnuntiusAdvertisingEUNo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- Before consentAller MediaCDN / HostingEUNo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- Before consentBunny.netCDN / HostingEUNo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- Before consentDagbladet apps (Aller Media)Aller MediaCDN / HostingEEANo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- Before consentDagbladet static (dbstatic.no)CDN / HostingEUNo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- Before consentEchoboxAnalyticsEUNo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- Before consentImprove Digital (360yield)AzerionAdvertisingEUNo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- Before consentKilkayaAnalyticsEUNo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- Before consentMediaconnectMarketing AutomationEEANo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- Before consentMedialabenAdvertisingEUNo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- Before consentMedietallAnalyticsEUNo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- Before consentNIFS (Norsk og Internasjonal Fotball-Statistikk)Video / EmbedEEANo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- Before consentNorsk Tipping PartnerNorsk TippingAffiliateEEANo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- Before consentNTB (Norsk Telegrambyrå)Video / EmbedEEANo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- Before consentReadpeakAdvertisingEUNo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- After consentOnAudienceCloud TechnologiesAdvertisingEUNo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- After consentRTB HouseAdvertisingEUNo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- After consentSemasioAdvertisingEUNo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
- After consentSmart AdServer / EquativAdvertisingEUNo third-country transfer mechanism inferred from ownership; verify actual processing locations and entities
| Observed service | Category | Region | Possible mechanism / review | Loaded |
|---|---|---|---|---|
| i18nexus | JS Library / CDN | US-owned | DPF status unknown; customer verification required | Before consent |
| jsDelivr | CDN / Hosting | Global | Possible mechanism unknown; customer verification required | Before consent |
| JW Player | Video / Embed | US-owned | DPF status unknown; customer verification required | Before consent |
| Magnite (Rubicon Project) | Advertising | US-owned | DPF status unknown; customer verification required | Before consent |
| Maze | Product Analytics | US-owned | DPF status unknown; customer verification required | Before consent |
| SmartyAds | Advertising | Unknown | Possible mechanism unknown; customer verification required | Before consent |
| Sourcepoint | Cookie Consent | US-owned | DPF status unknown; customer verification required | Before consent |
| Adobe (Marketing / Analytics) | Product Analytics | US-owned | DPF status unknown; customer verification required | After consent |
| Nielsen eXelate(Nielsen) | Advertising | US-owned | DPF status unknown; customer verification required | After consent |
| Sharethrough(Equativ) | Advertising | US-owned | DPF status unknown; customer verification required | After consent |
| Sovrn | Advertising | US-owned | DPF status unknown; customer verification required | After consent |
| Yieldmo | Advertising | US-owned | DPF status unknown; customer verification required | After consent |
| AWS CloudFront(Amazon) | CDN / Hosting | US-owned | DPF may apply to the matched entity; customer verification required | Before consent |
| Cloudflare | CDN / Hosting | US-owned | DPF may apply to the matched entity; customer verification requiredVerified 3 Aug 2026 · Cloudflare, Inc. | Before consent |
| Google Analytics(Alphabet) | Analytics | US-owned | DPF may apply to the matched entity; customer verification required | Before consent |
| Google APIs / GStatic(Alphabet) | CDN / Hosting | US-owned | DPF may apply to the matched entity; customer verification required | Before consent |
| Google Fonts(Alphabet) | Fonts | US-owned | DPF may apply to the matched entity; customer verification required | Before consent |
| Google Publisher Tag(Alphabet) | Advertising | US-owned | DPF may apply to the matched entity; customer verification required | Before consent |
| Index Exchange (Casale Media) | Advertising | Canada | Canadian adequacy may apply to qualifying organisations; customer verification required | Before consent |
| PubMatic | Advertising | US-owned | DPF may apply to the matched entity; customer verification requiredVerified 3 Aug 2026 · PubMatic Inc. | Before consent |
| Xandr / AppNexus(Microsoft) | Advertising | US-owned | DPF may apply to the matched entity; customer verification required | Before consent |
| Zendesk | Customer Support | US-owned | DPF may apply to the matched entity; customer verification requiredVerified 3 Aug 2026 · Zendesk, Inc. | Before consent |
| Amazon Ads(Amazon) | Advertising | US-owned | DPF may apply to the matched entity; customer verification required | After consent |
| Google Ad Traffic Quality(Alphabet) | Security / Bot Protection | US-owned | DPF may apply to the matched entity; customer verification required | After consent |
| OpenX | Advertising | US-owned | DPF may apply to the matched entity; customer verification requiredVerified 3 Aug 2026 · OpenX | After consent |
| reCAPTCHA(Alphabet) | Security / Bot Protection | US-owned | DPF may apply to the matched entity; customer verification required | After consent |
| The Trade Desk | Advertising | US-owned | DPF may apply to the matched entity; customer verification requiredVerified 3 Aug 2026 · The Trade Desk, Inc. | After consent |
| TripleLift | Advertising | US-owned | DPF may apply to the matched entity; customer verification requiredVerified 3 Aug 2026 · TripleLift | After consent |
| Adform | Advertising | EU | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | Before consent |
| Adnuntius | Advertising | EU | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | Before consent |
| Aller Media | CDN / Hosting | EU | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | Before consent |
| Bunny.net | CDN / Hosting | EU | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | Before consent |
| Dagbladet apps (Aller Media)(Aller Media) | CDN / Hosting | EEA | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | Before consent |
| Dagbladet static (dbstatic.no) | CDN / Hosting | EU | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | Before consent |
| Echobox | Analytics | EU | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | Before consent |
| Improve Digital (360yield)(Azerion) | Advertising | EU | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | Before consent |
| Kilkaya | Analytics | EU | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | Before consent |
| Mediaconnect | Marketing Automation | EEA | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | Before consent |
| Medialaben | Advertising | EU | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | Before consent |
| Medietall | Analytics | EU | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | Before consent |
| NIFS (Norsk og Internasjonal Fotball-Statistikk) | Video / Embed | EEA | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | Before consent |
| Norsk Tipping Partner(Norsk Tipping) | Affiliate | EEA | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | Before consent |
| NTB (Norsk Telegrambyrå) | Video / Embed | EEA | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | Before consent |
| Readpeak | Advertising | EU | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | Before consent |
| OnAudience(Cloud Technologies) | Advertising | EU | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | After consent |
| RTB House | Advertising | EU | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | After consent |
| Semasio | Advertising | EU | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | After consent |
| Smart AdServer / Equativ | Advertising | EU | No third-country transfer mechanism inferred from ownership; verify actual processing locations and entities | After consent |
Observed ownership, DPF matches and request timing are technical signals, not conclusions about processor roles, processing locations or transfer legality. Customer verification is required before updating legal records.
Infrastructure & jurisdiction
Observed Edge delivery, origin hosting, email routing and authoritative DNS, classified by provider ownership where known.
- Edge / CDN / proxyCloudflareUS-owned
Response headers identify Cloudflare (United States) as an edge, CDN or reverse-proxy provider. This does not establish the origin host or processing location.
cf-ray - Origin hosting: Not established from the available signals.
- Email (MX)Microsoft 365US-owned
MX records indicate that Microsoft 365 (United States) handles inbound mail routing for this domain. Review the actual processing and contractual arrangement.
dagbladet-no.mail.protection.outlook.com - DNS (NS)CloudflareUS-owned
NS records identify Cloudflare (United States) as an authoritative DNS provider. This is a potential jurisdictional dependency to review alongside contracts and actual processing.
gordon.ns.cloudflare.com
Provider detection is best-effort. Response headers can identify an edge layer but do not reveal an origin hidden behind a reverse proxy.
EU Independence Score
An experimental signal computed from detected third parties. 14 US-owned vendors detected. Score reflects jurisdiction risk weighted by what each vendor does. Not a compliance rating. Non-EU-owned email and DNS infrastructure was also factored in.
Baseline observations before consent interaction across 20 scanned pages: 33 classified services, 4 unmatched third-party domains, first-party ownership and observed infrastructure.
- Baseline+100
- Vendor risk, jurisdiction × category (14 groups)Alphabet (4 services), Magnite (Rubicon Project), PubMatic, Xandr / AppNexus, … — capped at −60-60
- Non-EU service ratio (48% of classified)16 of 33 classified services are significantly non-EU owned.-10
- Unmatched third-party domains (4)-16
- Non-EU infrastructureemail (Microsoft 365); DNS (Cloudflare)-9
- Total5
A StackPatrol-defined sovereignty indicator, not an industry standard or compliance score.
Detected services
48 services across 12 categories · highest-risk first · 15 marked load only after consent
Unmatched third-party domains
These domains were detected but not yet matched to a known vendor in our database.
eu-img-cdn.livecenter.comlivecenter.norkon.netlivecentercdn.norkon.netwww.e-pages.dkRecommendations
- Review AWS CloudFront if you want a European alternative. Options include Bunny.net, Scaleway Edge, OVHcloud CDN.
- Review Cloudflare if you want a European alternative. Options include Bunny.net, KeyCDN (Switzerland).
- Review Google Analytics if you want a European alternative. Options include Plausible, Matomo, Simple Analytics.
- Review Google APIs / GStatic if you want a European alternative. Options include Bunny CDN.
- Review Google Fonts if you want a European alternative. Options include Bunny Fonts (bunny.net), Self-hosted fonts.
- Review Google Publisher Tag if you want a European alternative. Options include Adnuntius, Adform.
- Review i18nexus if you want a European alternative. Options include Lokalise (LV), Crowdin (EE/UA).
- Review JW Player if you want a European alternative. Options include Bunny Stream.
A note on this report
StackPatrol is the technical map your DPO needs before the legal review. It surfaces the third-party services your site loads and where those vendors are based, so the legal analysis starts from facts, not guesswork.
What we provide is a technical signal: ownership region, observed network requests, vendor metadata. Legal applicability— whether a specific vendor or data flow is lawful for your use case — depends on your contracts, DPAs, sub-processors, data categories, and legal basis. We don’t give legal advice.
Catalog version 2026.08.09 · 763 service patterns · metadata reviewed 9 August 2026.
Your site next
Run this on your own site.
Free, no login required, results in under a minute. Paid plans add consent-aware scanning, deeper crawls and PDF reports.